173.234.226.85📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target IP: 173.234.226.85/32

Date: Current Intelligence Cycle

Classification: MODERATE RISK / HIGH ABUSE SUBNET

## EXECUTIVE SUMMARY

The IP address 173.234.226.85 is a colocation hosting endpoint operated by Leaseweb USA, Inc. (ASN 394380) in Dallas, Texas. While the endpoint itself shows moderate risk characteristics with no active services, it resides within a high-abuse subnet (173.234.226.0/24) exhibiting significant threat concentration. No active threat indicators or blacklisting were observed on the target IP.

## OWNERSHIP & INFRASTRUCTURE

• Organization: Leaseweb USA, Inc.
• ASN: 394380
• Geolocation: United States, Texas, Dallas
• Network Role: Colocation hosting / Game servers infrastructure
• Infrastructure Type: Hosting provider environment
• BGP Prefix: 173.234.224.0/22

## RISK ASSESSMENT

• Overall Risk Score: 50 (Moderate)
• Operator Score: 0.1304 (Minimal)
• DNSBL Listings: 2 of 8 total threat intelligence feeds
• Known Attacker: No
• Tor Exit Node: No
• Active Services: None detected (firewalled/no services)
• Open Ports: None observed

## SUBNET THREAT CONTEXT (173.234.226.0/24)

• Abuse Density: 0.8672 (High)
• Classification: High Abuse
• Active Siblings: 226 of 256 total IPs
• Threat Siblings: 222 IPs flagged as threats
• Inherited Risk: 34 (substantial neighborhood risk factor)
• Neighbor Risk Distribution: 100 medium-risk endpoints observed

## OBSERVATION HISTORY

• Total Observations: 41 signals recorded
• Recent Activity: Continuous monitoring observed June 18-19, 2026
• Risk Trend: Stable minimal operator scores (0.1304) with low confidence (0.23-0.30)
• Threat Persistence: Single observation event; not classified as persistently malicious
• Route Stability: Not stable (0 route changes in 30-day window)

## NETWORK RELATIONSHIPS

• Total Relationships: 142 entities linked
• Primary Connection: Same network LU-79 (137+ relationships)
• Organization/Hostname/Certificate Links: Not observed

## RECOMMENDED ACTIONS

1. Network Monitoring: Monitor subnet 173.234.226.0/24 for lateral movement from high-risk sibling IPs (222 threat siblings identified)

2. Traffic Analysis: Implement egress filtering for this IP range given the hosting infrastructure role

3. Threat Correlation: Cross-reference 222 threat-sibling IPs with internal logs for potential IOC correlation

4. DNSBL Monitoring: Investigate the 2 DNSBL listings against internal threat intelligence

5. Subnet Scanning: Consider proactive scanning of /24 subnet to identify active malicious endpoints

## ANALYST NOTES

The IP represents infrastructure-level hosting with no direct service exposure. Primary risk stems from subnet context rather than endpoint-specific indicators. The high abuse density of the /24 subnet suggests compromised or misconfigured endpoints are common in this infrastructure. SOC teams should focus on correlating this IP with other malicious activity originating from the same subnet rather than treating 173.234.226.85 as a standalone threat vector.

Priority: MEDIUM

Confidence: MODERATE

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.